Over the past two years, healthcare leaders have been forced to rethink what operational resilience really means.
The cyberattack on Change Healthcare demonstrated how dependent providers had become on a single third-party platform for everything from claims processing to cash flow. The attack on Ascension showed how quickly disruptions to technology can spill over into clinical operations, delaying care, forcing clinicians back to paper documentation, and disrupting the day-to-day functioning of hospitals across the country. While the headlines focused on cybersecurity, both events underscored a much broader lesson: healthcare organizations are only as resilient as the network of third parties they depend on every day.
Most hospitals responded by strengthening cybersecurity, evaluating supplier risk, and reassessing business continuity plans. Those were the right priorities. But another question deserves equal attention. Do hospitals truly understand every third party that has meaningful access to their facilities, systems, and operations?
For decades, vendor credentialing has been built around a straightforward assumption: the highest risk comes from the people working closest to patients. That philosophy shaped accreditation standards, influenced hospital policies, and created rigorous oversight for medical device representatives and other clinical vendors entering operating rooms and procedural areas.
It was an effective model because it reflected the way hospitals operated at the time. Today’s hospitals operate very differently.
Modern health systems rely on an extensive network of third-party personnel who rarely fit the traditional definition of a clinical vendor. Biomedical technicians maintain connected medical equipment. Facilities contractors oversee mechanical systems that support patient care environments. Environmental services teams work throughout patient units. Food service vendors, elevator mechanics, security contractors, IT specialists, construction crews, and maintenance personnel move throughout hospitals every day to keep operations running.
Most of these individuals never step inside an operating room. Many have access to patient care areas, restricted spaces, connected technologies, or critical infrastructure that directly supports clinical operations. Yet they often fall outside the oversight models hospitals originally built for vendor credentialing.
That disconnect is becoming increasingly difficult to ignore because the nature of hospital risk has changed.
Healthcare has become one of the most operationally complex industries in the world. Clinical care depends on digital infrastructure. Building systems are increasingly connected. Medical devices communicate across networks. Critical utilities are monitored electronically. Hospitals rely on outside organizations not simply to deliver products but to maintain the systems that allow patient care to continue uninterrupted.
In other words, operational resilience and patient safety are no longer separate conversations.
A contractor repairing an air handling unit serving an intensive care unit may never interact directly with a patient, but the reliability of that system is fundamental to patient care. A biomedical technician servicing network-connected infusion pumps may never be classified as a traditional clinical vendor, yet their work intersects with cybersecurity, clinical engineering, and operational continuity. Even environmental services personnel routinely move throughout patient care areas where infection prevention, physical security, and operational efficiency all converge.
None of these examples represents an unusual circumstance. They represent an ordinary day inside a modern hospital. The challenge is that many credentialing programs continue to reflect yesterday’s assumptions about where vendor risk exists rather than today’s operational reality.
Healthcare has invested years building thoughtful credentialing programs that have strengthened accountability and improved patient safety. The issue is that those programs were designed around a narrower understanding of third-party access than hospitals manage today.
Expanding oversight does not mean treating every contractor exactly the same. A one-size-fits-all approach would simply create more administrative work without producing better outcomes. Instead, hospitals should begin thinking about third-party oversight the same way they approach enterprise risk management. The question should no longer be whether someone fits into an existing credentialing category. The better question is what level of operational risk that individual presents based on where they work, what systems they access, and how their activities could affect patient care or hospital operations.
That requires moving away from static credentialing toward a more dynamic understanding of third-party risk.
Annual verification may satisfy a compliance requirement, but it does little to address the reality that contractor assignments change, certifications expire, organizational relationships evolve, and access requirements shift over time. Hospitals have embraced continuous monitoring in cybersecurity because they understand risk changes every day. Third-party oversight should evolve with that same mindset.
The organizations making the greatest progress are also recognizing that vendor oversight is no longer the responsibility of a single department. It sits at the intersection of supply chain, facilities, clinical engineering, information security, compliance, infection prevention, and executive leadership. As hospitals become more interconnected, so do the risks they manage.
What Hospital Leaders Should Do Next
Rather than expanding existing credentialing programs indiscriminately, healthcare organizations should focus on aligning oversight with how hospitals actually operate today.
The first step is understanding the full third-party ecosystem. Many organizations have mature oversight for clinical vendors while maintaining far less visibility into facilities contractors, service providers, maintenance personnel, and other operational partners. Hospitals cannot effectively manage risks they have never fully defined.
Next, leaders should evaluate whether credentialing reflects current risk or historical assumptions. Oversight should be based on the environments individuals enter, the systems they access, and the potential operational impact of their work instead of broad job categories that may no longer reflect reality.
Hospitals should also rethink credentialing as an ongoing operational capability rather than a point-in-time administrative exercise. Continuous visibility into who is entering facilities, whether requirements remain current, and how access changes over time provides a more accurate picture of organizational risk than periodic verification alone.
Finally, third-party oversight should become part of broader enterprise resilience planning. The strongest organizations increasingly recognize that operational resilience depends on understanding not only the technologies that support patient care, but also the people who install, maintain, repair, and access them every day.
Healthcare has spent decades refining how it manages clinical risk. The next chapter is recognizing that operational resilience depends just as much on the people working behind the scenes as those delivering care at the bedside.
Hospitals know how to secure the operating room. The greater challenge, and the greater opportunity, is ensuring they have the same level of confidence in everyone else who walks through their doors.
About Mickey Meehan
Mickey Meehan is CEO of Green Security, where he works with healthcare organizations to strengthen vendor governance, credentialing, and operational resilience. With more than two decades of experience across healthcare operations, supply chain, and technology, he has held executive leadership roles at Premier, Mobitor, Zimmer, and MedPricer, helping health systems navigate complex purchasing, vendor, and workflow challenges.
